In answering an access request a controller must not disclose a consumer's social security number, driver's licence or other government identification number, financial account number, health insurance or medical identification number, account password or security questions and answers, or biometric data, but must tell the consumer with sufficient particularity that it has collected that information.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.